Join GitHub today

ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF f…
https://github.com/jpr5/ngrep

README.md

ngrep 1.47 (9.7.2017)

ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool
that allows you to specify an extended regular or hexadecimal expression to
match against data payloads of packets. It understands many kinds of protocols,
including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of
interface types, and understands BPF filter logic in the same fashion as more
common packet sniffing tools, such as tcpdump and snoop.

As well, it could be used to do plaintext credential collection, as with HTTP
Basic Authentication, FTP or POP3 authentication. Like all useful tools, it can
be used for good and for bad.

Visit EXAMPLES to learn more about how ngrep works and can be
leveraged to see all sorts of neat things.

Support, Feedback, & Patches

If you need help, have constructive feedback, or would like to submit a patch,
please visit ngrep's project at GitHub and use the online tools there. It will
help the author better manage the various requests and patches so that nothing
is lost or missed (as has been the case in the past, unfortunately).

Miscellany

Please see CREDITS for a partial list of the many people who helped make ngrep
what it is today. Also, please note that ngrep is released under a simple
BSD-style license, though depending on which regex library you compile
against, you'll either get the GPL (GNU regex) or Artistic (PCRE).